Qname Minimization

 This article aims to explain inconsistencies in the subdomain delegation process which can get exposed by a specific setting found on modern Resolvers: Qname Minimization

In the above subdomain delegation setup the answer for www.staging.sydney.unw.com will depend on whether Qname Minimization is enabled or disabled on your Recursive Resolver.

With Qname Minimization Enabled: The answer will be:  10.6.6.6

When this feature is enabled the resolver sends only the next part of the label of the FQDN at every stage of iteration:

CloudFare's 1.1.1.1 has this feature enabled as of this writing and hence our DNS name will resolve to 10.6.6.6:  

With Qname Minimization Disabled: The answer will be:  10.7.7.7

When this setting is disabled the resolver sends the full FQDN at every stage of the iteration: 

Google's 8.8.8.8 has this feature disabled as of this writing and hence it will resolve this DNS name to 10.7.7.7:

The fix:

The fix is quite simple. Once a subdomain has been delegated, ensure not to create any records at the same level or below that level of hierarchy in the parent zone. All those records should go in the zone for the subdomain. 

Here is the simple and correct way of performing subdomain delegation: 

Note that the records for the subdomains sydney.unw.com and staging.sydney.unw.com are now inside the corresponding respective hosted zones instead of the parent hosted zone.

This will ensure consistent and predictable DNS resolution across all resolvers which may or may not have this feature enabled.

For more content please check out my Course on DNS and Bind.

Thank you for reading!